SonicWall says professional services firms logged 3 billion IPS events in H1 2026

SonicWall said on Aug. 12 that professional services firms logged 3 billion IPS events in the first half of 2026, calling it the largest absolute attack volume of any industry it tracks.

The company said 460 organizations in the sector were actively detecting ransomware campaigns, which it described as the broadest exposure among the verticals it follows. SonicWall said the findings come from its 2026 Professional Services Protect Brief, a vertical-specific companion to its 2026 Cyber Protect Report.

The brief focuses on law firms, accountancies, consulting practices, engineering firms and managed service providers. SonicWall said the firms in this group hold client records tied to active legal matters, financial transactions and privileged communications. For managed service providers, the company said the risk also includes administrative credentials that can open access to client networks.

Michael Crean, SonicWall's senior vice president of managed services, said attackers want access to that data because one compromise can spread. In the release, he said a single compromised MSP credential can cascade into multiple client networks.

SonicWall said the brief is based on data from its global network of more than one million security sensors and examines attack patterns, exploitation vectors and ransomware campaigns affecting professional services in the first half of 2026. The company also named Ryuk and Sodinokibi as ransomware groups that target organizations with administrative access to other organizations, according to the release.

The release included a case study involving XimpleIT, a Colorado-based MSP that serves legal industry clients. SonicWall said XimpleIT deployed SonicWall Cloud Secure Edge across its law firm customer base after a client breach caused by an unpatched legacy VPN. The company said the setup replaced broad network trust with application-level, continuously verified access and prevented lateral movement across client environments.

Juan Serna, founder and IT director of XimpleIT, said SonicWall's support and platform help the company tell law firms their data is protected, not just monitored, according to the release.

SonicWall did not say in the release whether the 3 billion IPS events or the ransomware detections led to specific incidents, losses or disruptions. It framed the findings as a warning about the concentration of sensitive data in professional services and the spillover risk when one firm has access to many clients.

The company said the brief is part of its broader annual research reporting. It did not provide a separate timeline for follow-up disclosures in the release.

Sources

• PR Newswire press release: SonicWall research finds professional services firms overruled by their own cybersecurity gaps

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.